A biometric attribution approach identifies a keyboard actor based on timing between entered keystrokes. patterns tend to emerge in a timing interval between keystrokes entered by an actor. The keystroke patterns of an actor are analyzed to compute a signature exhibited by the actor. Gathered or intercepted keystroke patterns of an unknown actor are compared to identify a likelihood that typing sessions emanated from a common actor. keystroke activity of a purported suspect actor can be compared to a database or model of keystroke attributes for determining if the keystroke activity emanated from the same actor as other keystroke sequences. keystroke patterns rely only on the timing between keystrokes, as key data and upstroke information need not be gathered since the comparisons reply only on keystroke timing deltas.
|
1. In a computing environment having keyboard input devices operated by actors and responsive to keypresses on a keyboard, a method of assessing an identity of an actor, comprising:
identifying attributes derived from a keystroke interval between each of a plurality of keystrokes received from the keyboard based on an upstroke or downstroke;
comparing the identified attributes to a second set of attributes based on a second sequence of keystrokes using a feature set comparison, generating the second set of attributes further comprising gathering a plurality of intervals resulting from a sequence of keystrokes emanating from an origin; and
computing, based on the plurality of intervals and the origin, a probability that the plurality of keystrokes received from the keyboard and keystrokes corresponding to the second sequence of keystrokes emanated from a common keyboard actor.
15. In a computing environment having keyboard input devices operated by actors and responsive to keypresses on the keyboard, a method of assessing an identity of the actor, comprising:
identifying attributes derived from a keystroke interval between each of a plurality of keystrokes received from the keyboard;
comparing the identified attributes to a second set of attributes based on a second sequence of keystrokes, comparing the identified attributes further comprising:
demarcating a comparison sequence of a predetermined number of keystrokes for the identified attributes and the second set of attributes;
generating a respective vector of the comparison sequence having a sequence of elements such that each successive element in the sequence of elements represents a time interval from a previously pressed key; and
performing a comparison of the respective vectors based on the identified attributes and the second set of attributes; and
computing, based on the plurality of intervals and the origin, a probability that the plurality of keystrokes received from the keyboard and keystrokes corresponding to the second sequence of keystrokes emanated from a common keyboard actor.
12. In a computing environment having keyboard input devices operated by actors and responsive to keypresses on a keyboard, a method of assessing an identity of an actor, comprising:
identifying attributes derived from a keystroke interval between each of a plurality of keystrokes received from the keyboard;
comparing the identified attributes to a second set of attributes based on a second sequence of keystrokes using a feature set comparison, generating the second set of attributes further comprising gathering a plurality of intervals resulting from a sequence of keystrokes emanating from an origin; and
computing, based on the plurality of intervals and the origin, a probability that the plurality of keystrokes received from the keyboard and keystrokes corresponding to the second sequence of keystrokes emanated from a common keyboard actor, further comprising
removing upstroke information to generate a sequence of intervals, each interval in the sequence of intervals defined by a keystroke of a depressed key;
removing keystroke data information indicative of a value associated with the depressed key; and
generating a dataset of the intervals based on timing information between keystrokes in each sequence of keystrokes and the origin of the sequence of keystrokes.
17. A computer program embodying program code on a non-transitory medium that, when executed by a processor, performs steps for implementing, in a computing environment having keyboard input devices operated by actors and responsive to keypresses on the keyboard, a method of assessing an identity of the actor, the method comprising:
identifying attributes derived from a keystroke interval between each of a plurality of keystrokes received from the keyboard;
comparing the identified attributes to a second set of attributes based on a second sequence of keystrokes using a feature set comparison, further comprising;
generating the second set of attributes further comprises:
gathering a plurality of typing sessions, each typing session in the plurality of typing sessions resulting from a sequence of keystrokes emanating from an origin;
removing upstroke information to generate a sequence of intervals between each keystroke of a depressed key;
removing keystroke data information indicative of a value associated with the depressed key for the upstroke and downstroke; and
generating a dataset of the intervals based on timing information between keystrokes in each sequence of keystrokes and the origin of the sequence of keystrokes; and
computing, based on the plurality of intervals and the origin, a probability that the plurality of keystrokes received from the keyboard and keystrokes corresponding to the second sequence of keystrokes emanated from a common keyboard actor.
14. In a computing environment having keyboard input devices operated by actors and responsive to keypresses on a keyboard, a method of assessing an identity of an actor, comprising:
identifying attributes derived from a keystroke interval between each of a plurality of keystrokes received from the keyboard, the derived attributes including timing information indicative of a time delay between each keypress of the depressed keys, further comprising:
generating a plurality of feature set pairs, the feature set pairs based on keystroke sequences of a predetermined length; and
building a model based on the feature set pairs;
comparing the identified attributes to a second set of attributes based on a second sequence of keystrokes using the model, generating the second set of attributes further comprising gathering a plurality of intervals resulting from a sequence of keystrokes emanating from an origin;
transforming the timing information into a frequency domain for denoting patterns of timing intervals between depressed keys over a predetermined number of keystrokes;
comparing the patterns of timing intervals resulting from a plurality of typing sessions for computing a probability that an origin of a first typing session matches an origin of a second typing session of the plurality of typing sessions; and
computing, based on the plurality of intervals and the respective origin, a probability that the plurality of keystrokes received from the keyboard and keystrokes corresponding to the second sequence of keystrokes emanated from a common keyboard actor.
2. The method of
3. The method of
4. The method of
5. The method of
generating a plurality of feature set pairs, the feature set pairs based on keystroke sequences of a predetermined length; and
building a model based on classifying a feature set as having a common origin as another feature set in the plurality of feature set pairs.
6. The method of
7. The method of
8. The method of
9. The method of
training a model based on features indicative of a typing stylometry based on a frequency of intervals between keypresses;
receiving keystroke timing information resulting from an intercepted typing session having an origin of an unknown actor; and
applying the model to the keystroke timing information for identifying a second typing session having the same origin as the intercepted typing session.
10. The method of
11. The method of
13. The method of
16. The method of
projecting the respective vectors to compute a series of binary proportional pulse based on equidistant, duration invariant time segments indicative of segments during which a key was pressed.
|
This application is a continuation of earlier filed U.S. patent application Ser. No. 16/933,153 entitled “BIOMETRIC KEYSTROKE ATTRIBUTION,” filed on Jul. 20, 2020, the entire teachings of which are incorporated herein by this reference.
This invention was made with government support under contract no. FA8750-17-C-0015 awarded by the United States Government. The Government has certain rights in the invention.
Detection of bad actors in an information system is often focused on an entry point to that system. Most electronic network devices provide a form of user authentication to control access to the device. Passwords are a common authentication mechanism because of their simplicity and ease of validating a user's identity though a simple string match, but rely on keeping the password string a secret. An unauthorized actor need only obtain the password to masquerade as the user.
Biometric features may be employed as an alternate authentication mechanism, as they rely on inherent personal features that are difficult or impossible to replicate, steal, or falsify. Values based on fingerprints, voice, retinal scans and similar personal characteristics have been employed, but tend to impose additional complexity and cost into the authentication process, and are therefore not widely employed.
Both biometric and token based approaches have limitations. Cyber criminals often carry out attacks through encrypted tunnels behind a network of proxy computers which makes attributing the perpetrator of a crime very difficult to do. However, if authentication fails or is emulated by a malicious actor, subsequent activity may be identified by an attribution system that detects patterns of an actor in the course of unauthorized and/or malicious activities.
A biometric attribution approach identifies an actor remotely accessing a device based on timing between keystrokes entered on the device. Patterns tend to emerge in a timing interval between keystrokes entered by an actor. The keystroke patterns of an actor are analyzed to compute a typing model exhibited by the actor. Gathered or intercepted keystroke patterns of an unknown actor are compared to identify a likelihood that typing sessions emanated from a common actor across multiple cyber intrusions. Keystroke activity of a purported suspect actor can be compared to a database or model of keystroke attributes for determining if the keystroke activity emanated from the same actor as other keystroke sequences. Keystroke patterns rely only on the timing between keystrokes, as key data information of the actual key pressed need not be gathered since the comparisons rely only on keystroke timing intervals, or deltas.
In networked information systems, cyber criminals often carry out attacks through encrypted tunnels behind a network of proxy computers which makes attributing the perpetrator of a crime very difficult. However, a biometric typing model of the purported bad actor is obtainable through the timings of packets during transmission over the network. Pairs of encrypted packet sequences can be compared to provide a prediction of whether or not the encrypted sessions belong to the same actor based on the typing “stylometry” exhibited by the timing deltas.
Configurations herein are based, in part, on the observation that cyber crime and general “bad actors” in an information system often gain access through authentication breaches based on a legitimate user. Single factor authentication mechanisms such as a password can be compromised simply by obtaining the trusted credential—the password. An attribution approach, however, examines actions independently of the entry point. The vantage point of an attribution system differs from that of an authentication system. In the authentication case, the vantage point is the login prompt or entry point, meaning that the code that collects keystrokes is running on the system that the actor is attempting to authenticate to. In the attribution case, the vantage point is anywhere along the connection between the actor and the system such that all the packets flowing between them can be observed.
Biometric approaches rely on immutable features that are difficult, if not impossible, to duplicate. Unfortunately, conventional approaches employing keyboard stylometry suffer from the shortcoming of reliance on the character value of the depressed key, and compute a keypress duration by gathering both downstroke and upstroke timing.
Accordingly, configurations herein substantially overcome the shortcomings of key data and key depression timing by gathering timing deltas of intervals between keystrokes and computing patterns of the timing deltas that are agnostic to the character value of the depressed key. Such frequency domain processing is useful in a console interface context, where a keyboard exchange via a network is employed for information system access. Network traffic includes packets of keystroke data, which may be encrypted. Keystroke data is identifiable by a packet size of a single keystroke, and includes a transmission time based on the keypress. The gathered keystroke sequence therefore includes only timing information of each keypress, as the data in the packet may be encrypted, and provides keystroke intervals defining a sequence of keypress deltas.
In a particular configuration, in a network device having a console access link with a user input device, a method of attributing malicious cyberactivity to an actor employing the remote station includes identifying a received keystroke entry, and identifying a successive keystroke entry. A console, SSH (Secure Shell), RDP (Remote Desktop Protocol) or other user access medium that receives the keystrokes from the user and allows an inter-keystroke interval to be computed or derived may be employed. A time interval is measured between the received keystroke entry and the successive keystroke entry, and thus accumulates a sequence of time intervals resulting from a plurality of successive keystroke entries. Information of the collective time intervals is used to determine, based on a pattern in the accumulated sequence of time intervals, a probability of an identity of an actor entering the keystrokes.
In the disclosed approach, actor attribution to a particular keyboard session relies on a learned model of frequency characteristics. In a computing environment having keyboard input devices operated by actors and responsive to keypresses on the keyboard for generating encrypted packets indicative of a respective keypress, the disclosed approach for assessing an identity of the actor includes receiving a sequence of packets from a console interface, such that each packet in the sequence of packets is based on a keystroke on a keyboard defining the console interface.
An analysis identifies attributes derived from a keystroke interval between each of the keystrokes based on capture of the sequence of packets containing the keystrokes, and compares the identified attributes to a second set of attributes based on a second sequence of keystrokes. From corresponding attributes in each sequence, analysis results in a probability that the keystrokes corresponding to the received sequence of packets and keystrokes corresponding to the second sequence of keystrokes emanated from the same keyboard actor.
The foregoing and other objects, features and advantages of the invention will be apparent from the following description of particular embodiments of the invention, as illustrated in the accompanying drawings in which like reference characters refer to the same parts throughout the different views. The drawings are not necessarily to scale, emphasis instead being placed upon illustrating the principles of the invention.
In the discussion that follows, an example of keystroke timing analysis presents a machine learning (ML) model trained on keystroke timing deltas from intervals between keystrokes of a training set of typing sessions, which is then used to attribute sequences of keystrokes to actors. Typing, or keystroke entry, exhibits a biometric pattern that emerges over a number of keyboard sessions for a given actor. The ML model is trained on these frequency characteristics to compute a probability of a common actor for two given keyboard sessions.
Centralized computing systems rely on a central processing device, or host 120 in communication with the keyboard 112 and computing device 114 over a network 130. The console interface 118 transmits a character defined by each keystroke to the host 120, and receives replies in the form of characters for rendering on the monitor 116. The console interface 118 transmits keystrokes one character at a time in packets 150-1 . . . 150-N (150 generally) containing a value of the depressed key, typically based on an ASCII (American Standard Code for Information Interchange) code or similar mapping for alphanumeric character values.
In a secure system, the console interface 118 transmits the received keystrokes as packets 150 of encrypted characters to the host 120, often via tunneling. Such exchanges are typically accompanied by authentication appropriate to the access provided by the host 120. To hide their identities, cyber criminals often carry out attacks through encrypted tunnels behind a network of proxy computers, which makes attributing the perpetrator of a crime very difficult. However, an actor's biometric typing signature is obtainable through the timings of the packets 150 as they are sent through the network 130. Actor attribution includes computing a time interval between the received keystroke entry and the successive keystroke entries, therefore accumulating a sequence of time intervals resulting from successive keystroke entries. This allows a determination, based on a pattern in the accumulated sequence of time intervals, of a probability of an identity of the actor 110 entering the keystrokes.
Cyber defense organizations (e.g., incident response and cyber threat intelligence companies) generally perform two types of attribution to unmask these individuals and understand their motivations. One involves attributing activity on victim systems to specific cyber personas (e.g., social media account) and/or real-world identities. The other is concerned with attributing activity across victims to the same actors, regardless of whether their personas or identities are known. The approach herein facilitates the latter form of attribution. In other words, while we may not know the identity of an actor yet, we may attribute that whoever entered a keystroke sequence in Boston on Tuesday is the same as the person entering another sequence in New York on Thursday.
The information used to perform the attribution begins with forensic evidence and artifacts of the attack, derived from network traffic and compromised hosts, known in the industry as indicators of compromise (IOC). Traditionally, encrypted network traffic is not a rich source of IOC because the contents of the traffic cannot be observed by a third-party, since the characters in the packets 150 are encrypted. However, configurations herein are based on the observation that an actor's biometric typing signature can be recovered through the inter arrival time of the encrypted packets. The signature can be used to predict whether the encrypted sessions belong to the same user. Conversely, if a known signature can be obtained for a given actor, then the signature can be used to associate an unknown encrypted network session to a verified actor. The result is a network-based IOC that allows for the identification of common actors communicating over encrypted network sessions.
Conventional approaches to keyboard stylometry for user attribution typically require that the identifying keys (typed characters) are known. Configurations herein describe a system for performing user attribution, but with encrypted keystroke information where the character key data is unknown. This is done by generating features from the captured packets based on the timing deltas between packets and the frequencies at which they are sent. In other words, conventional approaches track patterns specific to particular keys, such as how long does “e” follow “a” in an “ae” pattern, or the interval between “c” and “h.” The disclosed approach requires only the raw keystroke timing information, not the key data information. Further, some approaches identify both key-down and key-up time, allowing computation of a “dwell time” during which the key remained depressed. The sampled packets 150 have only one keypress time; dwell time is not available, and thus patterns are based only on the key delta time between keystrokes.
Returning to
In most information processing systems, keyboard entry is the standard entry medium for alphanumeric data, as mouse inputs can be cumbersome for character data and voice transcription can be unreliable. Further, a proficient keyboard operator can enter text almost as fast as spoken words. For example, a simple metric might employ an average keystroke time, and reference a biometric repository 160 including a table of average key delta times for known actors, using an example string “QWERTY.” Each packet 150 includes key data and timing information, allowing a computation of a difference between the timing to yield the key delta. If an average key delta for the sequence is 0.26 seconds, a comparison with the repository 160 indicates that Actor Y, with an average of 0.25 s., is closest in contrast to Actor X with 0.20 s. and Actor Z with 0.30 s. Additional timing characteristics and frequency analysis may of course be undertaken and stored in the biometric repository 160, discussed further below.
Packets 150 may be captured by any suitable monitoring, sniffing or intercepting mechanism, generally capturing each transmitted packet through non-invasive monitoring of a communications line traversing the network 130 carrying the transmitted packet to the host 120. Packet interception occurs between a suitable destination computing device configured to receive and concatenate the keystroke entries into a command line for directing operation of the computing device. This may include a duplication or interception at the console interface, at the host 120, or at an intervening network device such as a router, hub or access point. Each transmitted packet 150 contains a value resulting from a single keystroke input action, which allows filtering of the received sequence of packets from other network traffic based on a frame size in the packet. Filtering and analysis is based on the frame size alone since the contained value remains undefined, as the character corresponding to the keystroke is an encrypted value and not needed for the timing delta computation.
Prior to assessing captured keystrokes of an unknown actor for identification, a comparison set is built by transforming a collection of known user keystrokes into a dataset that is representative of the encrypted keystroke traffic, which will later be employed to train and predict an ML model 250. Training a model for feature set matching based on timing and frequency attributes includes first gathering a representative data set. Data gathering may include publicly available datasets of typing sessions that are combined with a privately obtained supplementary dataset of keystrokes. Datasets originate from typing sessions 220-1 . . . 220-3 (220 generally) from sampled candidates 210-1 . . . 210-3 (210 generally), and are stored in a repository 160.
These datasets gathered for comparison and matching with the packet sequences 152 need to be normalized so that a subsequent matching is based on an “apples to apples” approach. Recorded keystrokes may be represented in a table 221, and typically contain the upstroke 222 and down-stroke 224 information for each key-press. However, because a keystroke appears as a single packet in an encrypted tunnel, upstroke information is removed from the dataset. Also, character information 226 (i.e., information about which particular key was pressed) is stripped away so that the available information is comparable to the packets 150 of unknown data, since the packets 150 provide only timing information. Generally, either one of upstroke or downstroke information can be retained to generate the keystroke interval. Alternatively, other measurement such as packet arrival or transmission time, timestamp, etc. of each keystroke packet may be gathered, as long as a series of timing intervals between successive keystrokes may be assessed.
Generation of a filtered dataset 230 of attributes therefore involves removing downstroke 224 information to generate a sequence of intervals between each keystroke of a depressed key, and removing keystroke data 226 information indicative of a value associated with the depressed key for the upstroke and downstroke. The generated dataset 230 of attributes is based only on timing information between keystrokes, and so any suitable consistent interval may be employed, such as upstroke, downstroke, packet transmission, etc.
Once the relevant dataset 230 has been built, the next step is to transform these masked keystroke timings into salient features to provide to the ML model 250. This set of steps may include apportioning or “slicing” the masked keystrokes into sets of keystrokes of a predetermined length. The greater the length, the more information is available per sample, but it will diminish the size of the training dataset. Sequences having lengths of 24 and 48 tend to work well. The attributes may also be based on a sequence of keystrokes received from a sliding window of a predetermined length over keystrokes received in a typing session from an actor.
An inter-key timing delta is calculated to represent information about a user's typing pattern. The timing information includes timing deltas indicative of an interval between each keypress of the depressed keys. Aggregated statistics on these time deltas such as the standard deviation can be gleaned from statistical models. Additionally, analysis transforms the keystroke timings into the frequency domain to build a complimentary feature set 240. The keystroke timings yield a series of intervals or keystroke deltas employed further below to denote patterns of timing intervals between depressed keys over a predetermined number of keystrokes.
Training further includes generating a plurality of feature set pairs, in which the feature set pairs are based on keystroke sequences of a predetermined length; and building a model based on classifying a feature set as having a common origin as another feature set in the plurality of feature set pairs. Pairs of calculated feature sets are collected (some from the same user, some from different users) so that sample pairs may be classified as coming from the same user or separate users.
Traditionally, a biometric attribution system would attempt to match a new feature set with a particular user for which it has examples. In practice this is not very useful because it is unlikely that cyber actors would be part of the dataset 230 used for training. For this reason, we specifically train a model that matches pairs of user data and predicts whether they come from the same person. With this methodology, the ML model 250 extends to correlate or associate two unknown encrypted sessions, or a single known session with an unknown session, after the model has been trained.
The dataset 230 is employed to train a model based on features indicative of a typing stylometry based on a frequency of intervals between keypresses. This involves using the pairs of feature sets to train a machine learning algorithm that is capable of binary classification, such as through gradient boosted trees or neural networks, for example. At this point an ML model 250 which classifies samples as belonging to the same user has been generated.
Once the ML model 250 is trained to recognize timing attributes indicative of corresponding typing sessions, an identification/matching component may be invoked for the process of obtaining keystrokes from encrypted traffic channels and generating attribution predictions from the trained ML model 250. In interactive terminals, such as secure shell (SSH), every keystroke by a given user is immediately sent through the wire as a separate IP packet. However, there are many other packets that are sent as well and a filtering system is needed to accurately capture the packets of interest.
Beneficially, all keystroke packets in an SSH session are the same size and can be filtered from the stream of information based on the frame size. Sequences of keystroke packets are filtered from other network traffic based on a frame size in the packet. Feature generation techniques are applied as described above to feed the trained model. At this point the newly captured signature can be compared against a sample from a known user's typing session to determine the chance of a match. Alternatively, the newly captured signal can be compared against another unknown signature to determine the chance that two unknown signatures are from the same person.
Continuing to refer to
Each typing sequence 260-1 . . . 260-2 (260 generally) is based on keyboard input devices 112 operated by actors 110 and responsive to keypresses on the keyboard for generating encrypted packets 261-1 . . . 261-N (first typing sequence 260-1)) and 262-1 . . . 262-N (second typing sequence 260-2) indicative of a respective keypress. The sequence of packets is received from a console interface where each packet 261, 262 in the sequence of packets is indicative of a keystroke on the keyboard 112 defining the console interface 118.
An analyzer 255 demarcates a comparison sequence of a predetermined number of keystrokes for the identified attributes and the second set of attributes. In the first typing sequence 260-1, a character sequence for “a” “s” “d” “f” is typed and the second typing sequence 260-2 has characters for “u” “i” “o” “p,” yielding four keystrokes for each. Since only the time deltas are needed, key data and upstroke/downstroke data is normalized into a vector for performing a comparison based on respective vectors based on identified attributes of each sequence. A first vector 270-1 and a second vector 270-2 are computed to denote a difference, or time delta between each keystroke. The times for the first typing sequence (starting from 0.0 s) is 0.15 s, 0.32 s and 0.50 s, resulting in vector values of 15, 17 and 18 hundredths of a second between keypresses. The second typing sequence has vector values of 14, 17 and 20 hundredths of a second between keypresses. For example, one comparison for a probability of the identity of the actor could employ a standard deviation in the sequence of time intervals for a predetermined number of keystrokes represented in the sequence of time intervals.
Further, any network latency due to packet propagation is deemed to be negligible, as timing information is expected to be sufficiently preserved in the packet stream.
The analyzer 255 invokes the ML model for attributes based on the time values in the respective vectors 270 to compare the identified attributes and compute a match probability 280 that the keystrokes corresponding to the received sequence of packets 261 and keystrokes corresponding to the second sequence of packets 262 emanated from the same keyboard actor. An identity of the actor need not be determined, and/or may be determined by other means, however even identifying that two typing sessions emanated from the same bad actor can be beneficial in attribution of actions to personas.
In implementation, comparing the identified attributes further comprises demarcating a comparison sequence of a predetermined number of keystrokes for the identified attributes and the second set of attributes, such as a series of a predetermined length or a sliding window. Each keystroke session results in a vector 270 having a sequence of elements such that each successive element in the sequence of elements represents a time interval from a previously pressed key. The analyzer 255 performs a comparison of respective vectors based on the identified attributes and the second set of attributes.
Referring to
Referring to
The foregoing is an example of a use of vector quantities as a predictor of a match or correspondence with other vector quantities. Other suitable matching approaches may be employed for comparing timing delta information gathered from two separate typing sessions and assessing a probability that the two sessions emanated from the same actor. It should be further noted that the match or correspondence need not rely on a known identity. A correspondence or match can indicate a common source (actor) of the typing sessions even if the actual identity is still unconfirmed, as the knowledge of a common actor producing both typing sessions is valuable.
In the computing environment 100 having keyboard input devices operated by actors and responsive to keypresses on the keyboard for generating encrypted packets indicative of a respective keypress, the method of assessing an identity of the actor includes, at step 600, gathering a plurality of typing session for analysis. Each typing session in the plurality of typing sessions results from a sequence of keystrokes emanating from an origin. The origin or actor is not significant at this stage, as it is unlikely that an adverse actor would be included in the training set. Since these typing sessions are logged from various sources, it is important to remove upstroke information to generate a sequence of intervals between each keystroke of a depressed key, as depicted at step 602. Also, each keystroke input action includes a depress and release of a key corresponding to the received keystroke entry, as shown at step 604, thus keystroke data information indicative of a value associated with the depressed key for the upstroke is also removed. The result is a dataset based on timing information between keystrokes in each sequence of keystrokes, as depicted at step 606. The timing information is transformed into the frequency domain for denoting patterns of timing intervals between depressed keys over a predetermined number of keystrokes, as disclosed at step 608 The timing information at this stage only includes timing deltas indicative of an interval between each keypress of the depressed keys. Frequency information is employed to generate a plurality of feature set pairs based on keystroke sequences of a predetermined length, as shown at step 610. A variety of approaches may be employed, however a constant sized segment or sliding window allows comparison of like-sized data aggregations. At step 612 the model 250 is built based on classifying a feature set 240 as having a common origin as another feature set in the plurality of feature set pairs, in other words to identify which timing characteristics and features emerge from a typing stylometry of a given actor. The model 650 is then trained for comparing the patterns of timing intervals resulting from a plurality of typing sessions for computing a probability that an origin of a first typing session matches an origin of a second typing session of the plurality of typing sessions, as shown at step 614.
Resuming at step 620, actor attribution of a new, unknown keystroke sequence is performed using the now trained ML model 250. From a network device having a console access link with a user input device such as a keyboard, a method of attributing malicious cyberactivity to an actor includes receiving a sequence of packets from the console interface, such that each packet in the sequence of packets is indicative of a keystroke on a keyboard defining the console interface. A typical adverse actor may attempt to perpetrate bad acts using a remote console interface. This allows packet based communication with a central server or host. Often a first item would be a password, however the attribution approach may be employed with any sequence of typed characters.
For example, in one context, a password entry may be detected as emanating from an unauthorized actor because the timing between the keystrokes does not line up with the true password owner. In other contexts, an ongoing sequence of keystrokes is analyzed at any point in the typing session, either in real time or during subsequent forensic analysis.
Since the console interface employs transmitted packets for transmission of keypresses to a host/server, a sniffer, datalogger or suitable network appliance captures each transmitted packet through non-invasive monitoring of a communications line carrying the transmitted packet to a computing device configured to receive and concatenate the keystroke entries into a command line for directing operation of the host/server computing device, as shown at step 622. Packet capture based on a network medium provides and distinguishes access protection of a remote entity based on network packet observation for keystroke activity.
In basic terms, keystroke timing information is gathered by identifying a received keystroke entry, as depicted at step 624, and identifying a successive keystroke entry at step 626. The analyzer 255 computes a time interval between the received keystroke entry and the successive keystroke entry, as disclosed at step 628, and over the course of one or more typing sessions a sequence of time intervals accumulates resulting from a plurality of successive keystroke entries, as shown at step 630. Upon gathering a quantum of keystroke timing information suitable for comparison, the ML model 250 of steps 600-614 is invoked to determine, based on a pattern in the accumulated sequence of time intervals, a probability of an identity of an actor entering the keystrokes, as shown at step 632.
This includes identifying attributes derived from a keystroke interval between each of a plurality of keystrokes received from the keyboard based on capture of the sequence of packets containing the keystrokes, as shown at step 650, and comparing the identified attributes to a second set of attributes based on a second sequence of keystrokes via the ML model 250, as depicted at step 652. Based on the gathered and learned keystroke timing delta information, the ML model 250 computes a probability that the keystrokes corresponding to the received sequence of packets and keystrokes corresponding to the second sequence of packets emanated from the same keyboard actor, as shown at step 654. In this manner, a model of keystroke timing attributes is built and allows attribution of different keyboard sessions to the same actor based on patterns in the captured/intercepted keystroke intervals.
Those skilled in the art should readily appreciate that the programs and methods defined herein are deliverable to a user processing and rendering device in many forms, including but not limited to a) information permanently stored on non-writeable storage media such as ROM devices, b) information alterably stored on writeable non-transitory storage media such as floppy disks, magnetic tapes, CDs, RAM devices, and other magnetic and optical media, or c) information conveyed to a computer through communication media, as in an electronic network such as the Internet or telephone modem lines. The operations and methods may be implemented in a software executable object or as a set of encoded instructions for execution by a processor responsive to the instructions. Alternatively, the operations and methods disclosed herein may be embodied in whole or in part using hardware components, such as Application Specific Integrated Circuits (ASICs), Field Programmable Gate Arrays (FPGAs), state machines, controllers or other hardware components or devices, or a combination of hardware, software, and firmware components.
While the system and methods defined herein have been particularly shown and described with references to embodiments thereof, it will be understood by those skilled in the art that various changes in form and details may be made therein without departing from the scope of the invention encompassed by the appended claims.
Slater, David, Morgan, Sean, Tenaglia, Scott D.
Patent | Priority | Assignee | Title |
Patent | Priority | Assignee | Title |
10572778, | Mar 15 2019 | Prime Research Solutions LLC | Machine-learning-based systems and methods for quality detection of digital input |
10652238, | Jun 10 2019 | Capital One Services, LLC | Systems and methods for automatically performing secondary authentication of primary authentication credentials |
10846434, | Nov 25 2015 | MASSACHUSETTS MUTUAL LIFE INSURANCE COMPANY | Computer-implemented fraud detection |
8285658, | Aug 25 2009 | CONCENTRIX SREV, INC | Account sharing detection |
9430626, | Oct 11 2012 | Intensity Analytics Corporation | User authentication via known text input cadence |
20110231935, | |||
20120098750, | |||
20150205955, | |||
20150372984, | |||
20180103047, | |||
20180349092, | |||
20180349583, | |||
20190332756, | |||
20200019635, | |||
20200057706, | |||
20200244639, | |||
20200351657, | |||
20200356665, | |||
20200387594, | |||
20210038159, | |||
20210110014, | |||
20210182369, | |||
20210236044, | |||
20220043913, | |||
20220197985, |
Executed on | Assignor | Assignee | Conveyance | Frame | Reel | Doc |
May 24 2022 | SLATER, DAVID | Two Six Labs, LLC | ASSIGNMENT OF ASSIGNORS INTEREST SEE DOCUMENT FOR DETAILS | 060973 | /0737 | |
May 25 2022 | MORGAN, SEAN | Two Six Labs, LLC | ASSIGNMENT OF ASSIGNORS INTEREST SEE DOCUMENT FOR DETAILS | 060973 | /0737 | |
Jun 11 2022 | TENAGLIA, SCOTT D | Two Six Labs, LLC | ASSIGNMENT OF ASSIGNORS INTEREST SEE DOCUMENT FOR DETAILS | 060973 | /0737 | |
Sep 02 2022 | Two Six Labs, LLC | (assignment on the face of the patent) | / |
Date | Maintenance Fee Events |
Sep 02 2022 | BIG: Entity status set to Undiscounted (note the period is included in the code). |
Date | Maintenance Schedule |
Nov 21 2026 | 4 years fee payment window open |
May 21 2027 | 6 months grace period start (w surcharge) |
Nov 21 2027 | patent expiry (for year 4) |
Nov 21 2029 | 2 years to revive unintentionally abandoned end. (for year 4) |
Nov 21 2030 | 8 years fee payment window open |
May 21 2031 | 6 months grace period start (w surcharge) |
Nov 21 2031 | patent expiry (for year 8) |
Nov 21 2033 | 2 years to revive unintentionally abandoned end. (for year 8) |
Nov 21 2034 | 12 years fee payment window open |
May 21 2035 | 6 months grace period start (w surcharge) |
Nov 21 2035 | patent expiry (for year 12) |
Nov 21 2037 | 2 years to revive unintentionally abandoned end. (for year 12) |